Remove nasty virus

[lfh003]

Nasty virus on daughter's laptop! Is it really named 'Internet Security'? Will not allow any app to run...no IE, run, regedit, Notepad, not anything. In Safe Mode, updated Malwarebytes, ran about 30 seconds and machine shutdown. Any thoughts?

 

[smorizio]

NortOns...mcafee and other good anti virus software give out free virus rescue iso image cd. To be boot from and clean infected systems.
Hirem boot cd also has free stuff and a mini xp boot to be able to copy her files to a backup drive if the hard drive needs to be nuked and paved.

 

[USAFRet]

Download, burn, boot and scan from a CD.
Hirens or Kaspersky

 

[ram1009]

If it's the "FBI" virus there's only one way I know of to remove it for sure. Go here http://www.surfright.nl/enand download Hitman Pro Kickstart.

 

[ish416]

You will need to run some preboots to get rid of this one.

Start here with Windows Defender Offline - http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline

Then, Bitdefender Rescue CD - http://www.bitdefender.com/support/how-to-create-a-bitdefender-rescue-cd-627.html

Finally, Avira Preboot - http://www.avira.com/en/download/product/avira-antivir-rescue-system

Once you run those you should be able to boot into the OS.

At that point try running Rkill - http://www.bleepingcomputer.com/download/rkill/

Then run TDSS Killer to check for any rootkits that the preboots may have missed - http://www.bleepingcomputer.com/download/tdsskiller/

Then run Combofix - http://www.bleepingcomputer.com/download/combofix/

Then run JRT - http://www.bleepingcomputer.com/download/junkware-removal-tool/

Then run MBAM - http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

Then ADW cleaner - http://www.bleepingcomputer.com/download/adwcleaner/

Now you should be Internet Security free.

 

[USAFRet]

You will need to run some preboots to get rid of this one.

Start here with ....

...way too many steps for me.
I'd just blow away the drive and install new. Retrieve essential files from backup.

Of course, that presupposes a virus free backup of essential data.

 

[lfh003]

I am unable to use an outside piece of hardware (cd or usb). Every 'f' key is followed by a system shutdown. I am able to get to 'safe mode and internet connection', but as I said earlier, after running the anti-virus software for a few seconds the system shuts down.
Looks like I am going to have to take the hdd out and attach it to my other laptop and try to clean it up. My daughter has too much material on the hdd to wipe it clean.
I am, also, USAF retired. A29372A, 1st MAS Andrews AFB, 1979.

 

[USAFRet]

You can't go into the BIOS before Windows boots and change the boot order? Change it to boot from DVD first?

(and thank you for your service)

 

[lfh003]

No can do. Anytime any app tries to launch, the app will disappear and the 'Internet Security' window will say that the particular app could not open. That includes run, regedit, etc.

 

[USAFRet]

No can do. Anytime any app tries to launch, the app will disappear and the 'Internet Security' window will say that the particular app could not open. That includes run, regedit, etc.

Before any apps, before Windows loads...BIOS.
Power off. Power on....whatever button it is to get to the BIOS..do that. F8 or DEL or whatever.

Change the boot order to DVD and boot from Kaspersky or Hirens disk.
The virus can't run if it never loads.

 

[lfh003]

I was trying, again, to get into any of the modes presented at start-up when I somehow got to Restore...previously the app would shutdown, but time it stayed active! I have successfully restored to June 11th. Now I have updated Malwarebytes and it is running a full scan of the hdd. This has been a most fortunate turn of events!!

Now...six hours later. After getting to Safe Mode with Internet Connection, Malwarebytes ran for about two minutes, then the screen when black and shortly thereafter the laptop shutdown. I got back to Safe Mode and tried to launch Malwarebytes again, shortly after launching the screen went black and the laptop shutdown again...that is where I am now. For anyone's edification, here is a good site for removing this virus, if your machine is able to run from Safe Mode.
http://malwaretips.com/blogs/internet-security-pro-2013-virus/

 

[Saga Lout]

...way too many steps for me.

Too many steps for anyone - ComboFix alone would do the trick.